LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

Security Considerations
Be aware of the following security considerations when you use ldapugmod:
• The ldapugmod tool requires an LDAP administrator permissions when it performs
operations on the directory server. The rights to modify existing LDAP directory entries
under the requested subtree, and to create, modify and remove the required attributes in
that entry must be granted to the administrator identity that you specify when executing
ldapugmod.
• With any POSIX-type identity, the user and group ID numbers are used by the HP-UX
operating system to determine rights and capabilities in the OS as well as in the file system.
For example, a root user ID 0 has unlimited OS administration and file access rights. Before
modifying an entry, you must be aware of the selected user and group ID number and any
policy that may be associated with that ID.
• Modification (renaming) of a POSIX account does not automatically modify that account’s
membership in groups, unless the LDAP directory server intrinsically provides that capability.
Some LDAP directory servers have a feature known as “referential integrity”, which performs
modification or removal of DN-type attributes if the specified DN is either changed or
removed
• As it may occur in any identity repository, modification of this repository has likely impacts
as defined by the organization security policy. When using ldapugmod, you are expected
to have full knowledge of the organization security policy and the impact of modifying
identity information in that identity repository.
Limitations
Because LDAP directories require data be stored according to the UTF-8 (RFC3629) character
encoding method, all characters displayed by ldapugmod are UTF-8, and assumed to be part of
the ISO-10646 character set. The ldapugmod tool does not perform conversion of the locale
character set to or from the UTF-8 character set.
Examples
This section provides examples of using the ldapugmod tool.
The following commands set the LDAP_BINDDN and LDAP_BINDCRED environment variables:
export LDAP_BINDDN = "cn=Jane Admin,ou=admins,dc=org,dc=example,dc=com"
export LDAP_BINDCRED = "Jane's password"
Run the following command to go to the /opt/ldapux/bin directory where ldapugmod
resides:
cd /opt/ldapux/bin
The following command changes the password of the user, mlee, using the new user password
defined in LDAP_UGCRED. You must specify the -PW option when using LDAP_UGCRED.
export LDAP_UGCRED = "mlee's new password"
./ldapugmod -t passwd -PW mlee
The following command replaces the uidNumber value for the user entry, mMackey:
./ldapugmod -t passwd -u 300 mMackey
The following command replaces the sn value for the user entry, mLou:
./ldapugmod -t passwd mLou "sn=Lou"
The following command replaces the gecos fields for the user entry, mLou:
./ldapugmod -t passwd -I "Mike Lou,Building-6,222-2222" mLou
LDAP User and Group Management Tools 211